Smart contract monitoring in 5 minutes: what to watch and how to set it up

A contract goes live after an audit. The audit checked the code on one day. From then on, the contract changes owner, gets upgraded, moves money and talks to bots, and somebody has to notice when one of those things is not supposed to happen.

Most small teams notice from users, from a block explorer tab left open, or from a post on X. SmartAlert is a monitor for that gap: you paste a contract address, and it tells your team in Telegram, Slack or Discord when something on the contract is off.

This post covers what it watches, and then takes a contract from "nobody is watching" to working alerts in about five minutes.

What it watches

SmartAlert reads public chain data on Ethereum, BNB Chain, Base and Arbitrum. It does not touch your contract and needs no code change.

Admin changes. Ownership transferred, a role granted or revoked, a proxy upgraded, the proxy admin changed, Safe owners or threshold changed, the contract paused. These are the first on-chain signs of most takeovers.
Money, in dollars. A transfer above $X, priced at the block and optionally filtered by sender. The total value of a treasury below a floor, including when a price drop crosses it. Prices come from Chainlink, with CoinGecko as a fallback.
Operations. A keeper or relayer wallet with gas for fewer than N days. A balance that is low and got no top-up in an hour. Failed transactions from your bots.
Activity. Any event count or value per hour: transfers, swaps, deposits, claims. Spikes, and a contract that suddenly goes quiet.
State. Values read through view functions, such as paused() returning true.

Two things keep the alerts useful:

A norm for each hour. Activity on most contracts is low at night and high during the day. One fixed threshold is either noisy at peak hours or silent at night. SmartAlert can compare each hour with the same hour on previous days instead, so a burst at 3 a.m. is caught and a busy afternoon is not an alert.
A check on history before a rule runs. Every rule shows, on a chart of the contract's real past, where it would have fired. If it would have fired forty times last month, you see that before it wakes anyone up.

Setup

You need a contract address on one of the four networks and a Telegram account. The free plan is enough; the first 14 days of a project work with Pro limits.

Step 1. Add the contract (1 minute)

Sign up and create a project.
Choose Add contract, pick the network and paste the address.
For a verified contract, the ABI is loaded for you. For an unverified one, paste the ABI.

If SmartAlert has not seen the contract before, it first collects its history. The contract shows a "backfilling" status, and rules wait until it is done. If the contract is already tracked, its history is there at once.

Step 2. Turn on the first rules (2 minutes)

Open the contract. SmartAlert suggests rules from its ABI: ERC-20, ERC-721 and ERC-1967 proxies get matching templates. Select the ones that fit and choose Enable selected.

If you are not sure what to start with, these six cover the most common ways a contract gets taken over or drained:

Rule	Why	Setting
Ownership transferred	A new owner can call every admin function	Any event, Critical
Role granted	A new admin on an `AccessControl` contract	Any event, Critical
Proxy upgraded	The code behind the address changed	Any event, Critical
Transfer above $X	The drain itself, priced at the block	`from` = your contract, a threshold above normal flow
Unusual transfer activity	Bursts that a fixed number misses at night	Against the norm for each hour
Contract went quiet	A broken integration or a stuck bot	Against the norm for each hour

If you run keepers or relayers, add their wallets and a gas runway rule. For a treasury, add its address and a total below $X rule.

Step 3. Check each rule on history (1 minute)

Open a rule and look at the chart. It shows the metric, the norm or your threshold, and marks where the rule would have fired.

Admin rules should show zero or a few marks, each one a change you remember making.
For value and activity rules, too many marks means the threshold is too low. Raise it, or set a target such as "no more than 2 a week" and let SmartAlert pick the threshold.

Use against the norm for each hour (the default) for activity, and own threshold for amounts in dollars and admin events.

Step 4. Connect Telegram (1 minute)

Open Channels, enter a name and press Add.
Open the link SmartAlert gives you and press Start in the bot. For a team chat, add the bot to the group and run the command there.
The bot replies with the project name. The channel is active.

The link works for 15 minutes. On Pro you can also add Slack, Discord, email, PagerDuty or a webhook.

What an alert looks like

The message has the value, the threshold or this hour's norm, the time and a link to the transaction. When the condition clears, a "Back to normal" message follows, and PagerDuty incidents close on their own.

What it does not do

It does not pause or block anything. It alerts. Send Critical alerts to people who hold a pause key; an alert that reaches nobody who can act is a log entry.
It does not read the mempool. It reads confirmed blocks. On Ethereum that is 12 confirmations, about 144 seconds, then a rule check: every 5 minutes on Free, every minute on Pro, every 30 seconds on Business. If an attacker drains a contract within two minutes of the first sign, the first loss is gone before any confirmed-block monitor can speak. Later steps of the same attack are not.
It does not replace an audit. It is the part that notices.

Two more habits:

Repeat on every chain you are deployed on. Attackers often go chain by chain, and the first chain's alert is the warning for the others.
Watch contracts you depend on, not only your own. A locker, a bridge or a vault that holds your tokens is public, and you can watch it without anyone's permission.